The healthcare company reported the breach on Monday, stating that patient names, emails, phone numbers, birthdates, and other personal information had been stolen and posted to a hacking forum.

According to HCA, the breach doesn’t include patients’ clinical information, payment details, or sensitive information like passwords, driver’s licenses, or social security numbers. HCA is working with law enforcement to investigate the incident, and says hackers might’ve stolen the information from “an external storage location exclusively used to automate the formatting of email messages.”